CVE-2026-111280 snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
Malicious PLCs can trigger an out-of-bounds write in snap7, causing memory corruption and crashes in SCADA or HMI systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111280?
CVE-2026-111280 is a high-severity memory corruption vulnerability in davenardella snap7, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
Weakness: CWE-787
Which versions are affected by CVE-2026-111280?
How do I fix CVE-2026-111280?
No fix has been published for CVE-2026-111280 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-111280 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111280 exists.
Sources
Also known as GHSA-3jmx-fccg-jcq7, UBUNTU-CVE-2026-111280.